InfoSecBulletin Cybersecurity for mankind
Qualcomm has unveiled its May 2026 Security Bulletin, revealing serious flaws with its software and hardware. The bulletin points out several Critical issues that could let unauthorized users access and damage memory on millions of devices using Qualcomm chipsets.
The company is sharing updates with Original Equipment Manufacturers (OEMs) and has advised them to install these updates on released devices as soon as they can.
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
The biggest flaw fixed this month is CVE-2026-25254, which has a CVSS score of 9.8. Discovered in the Qualcomm Software Center, this “Critical” flaw relates to wrong permissions in the SocketIO interface.
Vulnerability Type: Improper Authorization (CWE-285).
Impact: This flaw leads directly to Remote Code Execution (RCE).
Access Vector: Remote.
Affected Versions: QSC v1.17.1, v1.19.1, and v1.21.0.
An attacker could use this interface to run harmful commands without being near the device.
Another critical flaw resides at the very foundation of device security: the Primary Bootloader. Tracked as CVE-2026-25262, this “Write-what-where” condition occurs while the system processes a crafted ELF (Executable and Linkable Format) file.
While this attack needs local access, it causes serious memory damage that threatens boot integrity. This problem impacts various old and special chipsets, like the MSM8909, MSM8916, and SDX50.
Qualcomm also fixed a serious problem in its PLC (Power Line Communication) Firmware, known as CVE-2026-25293. This issue has a CVSS score of 9.6 and is due to wrong authorization that causes a buffer overflow. Like the Software Center issue, this flaw can be accessed from afar and affects the QCA7005 chipset. The risk is greater because the exploit can bypass security and affect the whole system.
Qualcomm makes the technology for many smartphone and IoT makers, so users can’t fix these problems themselves. You have to wait for your device maker (OEM) to give a system update.
